Debian 2.2 DSA-066-1 Critical: Cfingerd Remote Exploit Fix

Package : cfingerd
Problem type : remote exploit
Debian-specific: no

Steven van Acker reported on bugtraq that the version of cfingerd (a
configurable finger daemon) as distributed in Debian GNU/Linux 2.2
suffers from two problems:

1. The code that reads configuration files (files in which $ commands are
expanded) copied its input to a buffer without checking for a buffer
overflow. When the ALLOW_LINE_PARSING feature is enabled that code
is used for reading users files as well, so local users could exploit
this.

2. There also was a printf call in the same routine that did not protect
against printf format attacks.

Since ALLOW_LINE_PARSING is enabled in the default /etc/cfingerd.conf
local users could use this to gain root access.

This has been fixed in version 1.4.1-1.2, and we recommend that you upgrade
your cfingerd package immediately.

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.


Debian GNU/Linux 2.2 alias potato
------...